Regulatory Frameworks & Compliance Flashcards

A Spring Boot service must comply with CCPA and allow users to request deletion of their data. Which Spring Data feature simplifies implementing a 'right to be forgotten' endpoint?

Answer: A custom service method calling repository delete operations wrapped in a saga pattern

A right-to-be-forgotten workflow typically spans multiple tables and services, so a transactional service method orchestrating multiple repository deletes (possibly with a saga for distributed systems) is the correct approach.

Which Spring Boot Actuator endpoint provides runtime evidence for a SOX audit that the application's configuration has not changed since deployment?

Answer: /actuator/info with build metadata

/actuator/info can expose git commit hash and build timestamp from META-INF/build-info.properties, giving auditors a verifiable artifact tying the running binary to a specific source commit.

How should a Spring Security configuration be structured to comply with OWASP's requirement that authentication failures do not reveal whether the username or password was wrong?

Answer: Always throw BadCredentialsException regardless of whether the user exists or the password is wrong

Spring Security's DaoAuthenticationProvider hides UsernameNotFoundException behind a generic BadCredentialsException by default to prevent username enumeration attacks.

Which Spring framework feature supports FedRAMP's requirement for continuous monitoring by exporting application metrics to an external monitoring system?

Answer: Micrometer with a Prometheus or Datadog registry configured in Spring Boot Actuator

Micrometer is Spring Boot Actuator's metrics facade; configuring a Prometheus or Datadog registry pushes runtime metrics to external monitoring platforms required by FedRAMP continuous monitoring.

A compliance requirement mandates that all inter-service HTTP calls within a Spring Cloud application use mutual TLS (mTLS). Where is this best configured?

Answer: At the service mesh layer (e.g., Istio sidecar), keeping Spring services unaware

A service mesh like Istio handles mTLS transparently via sidecar proxies, removing the certificate management burden from individual Spring services.

Under ISO 27001 Annex A, access rights must be reviewed regularly. Which Spring Security feature can automatically expire user sessions after a compliance-defined period of inactivity?

Answer: Setting server.servlet.session.timeout in application.properties

server.servlet.session.timeout (or spring.session.timeout for Spring Session) sets the inactivity timeout after which the server invalidates the session, enforcing access review requirements.

Which approach does Spring Authorization Server use to support PKCE, which is required for public clients under OAuth 2.1 compliance?

Answer: Enabling code_challenge and code_challenge_method parameters in the authorization request flow

PKCE requires the client to send a code_challenge in the authorization request and a code_verifier in the token request; Spring Authorization Server validates this exchange automatically when PKCE is configured.